PT-2025-24542 · Unknown · React-Native-Keys

Ch3Tanbug + 1 · Published 2025-06-09 · Updated 2025-06-23 · CVE-2025-45001

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions react-native-keys version 0.7.11

Description The issue concerns sensitive information disclosure, where encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools.

Recommendations For react-native-keys version 0.7.11, consider removing or securely storing sensitive information to prevent disclosure. As a temporary workaround, restrict access to the compiled native binary to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-45001

GHSA-FJ44-H6XW-896G

Affected Products

React-Native-Keys

References · 12

• 🔥 https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45001 · Exploit
• 🔥 https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5 · Exploit
• https://osv.dev/vulnerability/CVE-2025-45001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fj44-h6xw-896g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45001 · Security Note
• https://github.com/numandev1/react-native-keys · Note
• https://t.me/cvetracker/25807 · Telegram Post
• https://twitter.com/CVEnew/status/1932141196815802574 · Twitter Post
• https://twitter.com/Ch3tan_bug/status/1932131872211136905 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1932302988699164853 · Twitter Post
• https://twitter.com/dailycve/status/1937170849569673300 · Twitter Post
• https://t.me/cvenotify/126385 · Telegram Post